mirror of
https://github.com/netbirdio/netbird.git
synced 2026-09-12 17:59:06 +02:00
Zoltán Papp
41906d4a1a
The file drop server listened on 41421, which falls inside the ephemeral port range on Linux (32768-60999) and Windows (49152-65535), so any outbound connection could take it after boot. The receiver then bound a dynamic port and advertised it over signaling, and the sender waited for that advertisement before retrying. That coupled a data plane feature to signaling traffic: once a peer connection is established there is no reason for another offer or answer to go out, so a sender could wait out the grace period for an advertisement that never came. Move the port to 22042, next to the SSH (22022) and DNS forwarder (22054) ports and clear of both ephemeral ranges, and keep the tunnel side fixed the way SSH does. A receiver that cannot bind it falls back to a dynamic port and redirects 22042 to it with an inbound DNAT rule, so senders always dial the well known port and never negotiate. NB_FILEDROP_PORT overrides the local bind only. The DNAT runs ahead of the filter on every backend (nftables prerouting at NAT dest priority, iptables nat/PREROUTING, and the userspace filter's translate-then-redecode path), so the netstack service registry keeps taking the bound port. This drops the port registry, the retry that waited on it, and the signaling plumbing that fed it.
98 lines
2.5 KiB
Go
98 lines
2.5 KiB
Go
package client
|
|
|
|
import (
|
|
"context"
|
|
"fmt"
|
|
"io"
|
|
"net/netip"
|
|
"strings"
|
|
|
|
"github.com/netbirdio/netbird/shared/signal/proto"
|
|
"github.com/netbirdio/netbird/version"
|
|
|
|
"golang.zx2c4.com/wireguard/wgctrl/wgtypes"
|
|
)
|
|
|
|
// A set of tools to exchange connection details (Wireguard endpoints) with the remote peer.
|
|
|
|
const (
|
|
StreamConnected Status = "Connected"
|
|
StreamDisconnected Status = "Disconnected"
|
|
|
|
// DirectCheck indicates support to direct mode checks
|
|
DirectCheck uint32 = 1
|
|
)
|
|
|
|
// Status is the status of the client
|
|
type Status string
|
|
|
|
type Client interface {
|
|
io.Closer
|
|
StreamConnected() bool
|
|
GetStatus() Status
|
|
Receive(ctx context.Context, msgHandler func(msg *proto.Message) error) error
|
|
Ready() bool
|
|
IsHealthy() bool
|
|
WaitStreamConnected(context.Context)
|
|
SendToStream(msg *proto.EncryptedMessage) error
|
|
Send(msg *proto.Message) error
|
|
SetOnReconnectedListener(func())
|
|
}
|
|
|
|
// Credential is an instance of a GrpcClient's Credential
|
|
type Credential struct {
|
|
UFrag string
|
|
Pwd string
|
|
}
|
|
|
|
// CredentialPayload bundles the fields of a signal Body for MarshalCredential.
|
|
type CredentialPayload struct {
|
|
Type proto.Body_Type
|
|
WgListenPort int
|
|
Credential *Credential
|
|
RosenpassPubKey []byte
|
|
RosenpassAddr string
|
|
RelaySrvAddress string
|
|
RelaySrvIP netip.Addr
|
|
SessionID []byte
|
|
}
|
|
|
|
// UnMarshalCredential parses the credentials from the message and returns a Credential instance
|
|
func UnMarshalCredential(msg *proto.Message) (*Credential, error) {
|
|
|
|
credential := strings.Split(msg.GetBody().GetPayload(), ":")
|
|
if len(credential) != 2 {
|
|
return nil, fmt.Errorf("error parsing message body %s", msg.Body)
|
|
}
|
|
return &Credential{
|
|
UFrag: credential[0],
|
|
Pwd: credential[1],
|
|
}, nil
|
|
}
|
|
|
|
// MarshalCredential marshal a Credential instance and returns a Message object
|
|
func MarshalCredential(myKey wgtypes.Key, remoteKey string, p CredentialPayload) (*proto.Message, error) {
|
|
body := &proto.Body{
|
|
Type: p.Type,
|
|
Payload: fmt.Sprintf("%s:%s", p.Credential.UFrag, p.Credential.Pwd),
|
|
WgListenPort: uint32(p.WgListenPort),
|
|
NetBirdVersion: version.NetbirdVersion(),
|
|
RosenpassConfig: &proto.RosenpassConfig{
|
|
RosenpassPubKey: p.RosenpassPubKey,
|
|
RosenpassServerAddr: p.RosenpassAddr,
|
|
},
|
|
SessionId: p.SessionID,
|
|
}
|
|
if p.RelaySrvAddress != "" {
|
|
body.RelayServerAddress = &p.RelaySrvAddress
|
|
}
|
|
if p.RelaySrvIP.IsValid() {
|
|
body.RelayServerIP = p.RelaySrvIP.Unmap().AsSlice()
|
|
}
|
|
return &proto.Message{
|
|
Key: myKey.PublicKey().String(),
|
|
RemoteKey: remoteKey,
|
|
Body: body,
|
|
}, nil
|
|
}
|